Privacy Policy
This Privacy Policy explains what Rehla collects, how we use it, and the choices available to parents and guardians. Rehla is a family app for children aged 6–8 built around parent-curated YouTube videos, and is designed to comply with COPPA, GDPR-K, the Apple Kids Category, and Google Play's Designed for Families program.
1. Who this policy covers
Rehla has two kinds of user: parents/guardians, who own the account, grant consent, add content, and configure kid profiles; and kids, who use a sandboxed, parent-curated interface and never create accounts themselves. All data about a child is owned and controlled by the parent account.
2. Information we collect
From parents: email, name, a bcrypt hash of your password, a hashed parent PIN, optional locale, and subscription state (from the App Store or Google Play — we never see payment credentials). From kid profiles you create: first name or nickname, birth year (for age defaults — no month or day), avatar, and preferences (daily limit, bedtime, autoplay, search). Usage: which videos were watched, for how long, and completion, plus daily watch-time totals per kid. Technical: a per-device session fingerprint for the one-active-device rule, and standard server logs (IP, user-agent, timestamp, path).
3. How we use information
To run the service (show the right videos, enforce limits, render parent dashboards), authenticate and secure accounts, send transactional email (verification, password reset, invites, receipts), diagnose problems, and meet our legal obligations.
4. Parental consent (COPPA)
Before a child uses Rehla, a parent must create an account with a valid email, click the verification link we send, and then add each kid profile from the verified dashboard. Each kid addition records an auditable parental-consent entry tied to the parent's verified email. This email-plus verification satisfies COPPA's parental-consent requirement.
5. No ads, no tracking, no selling
We do not sell personal information. We do not use kid data for targeted advertising. There are no third-party advertising SDKs, cross-site tracking, or behavioral-advertising identifiers in the kids' experience.
6. Who we share with
We share data only with service providers that help us run Rehla — hosting, transactional email, and subscription management (RevenueCat) — under contract and only as needed. Videos play via YouTube's IFrame player; when a video plays, YouTube receives the request needed to serve it. We do not host or redistribute YouTube content. Rehla is an independent app that helps you organize YouTube content for your child. It is not affiliated with, endorsed by, or sponsored by YouTube or Google LLC. YouTube™ and the YouTube logo are trademarks of Google LLC. All video content remains the property of its respective creators and is streamed via the YouTube embedded player (YouTube IFrame Player API); Rehla does not host, modify, or claim ownership of any video content.
7. Data retention
Watch-session detail is automatically deleted 90 days after it is created. Server request logs are retained for up to 30 days for security. Account and profile data is kept until you delete it.
8. International transfers
Rehla is operated by Blink22 (United Arab Emirates). Your information may be transferred to and processed in the countries where our hosting and service providers operate. For EU/UK users we rely on Standard Contractual Clauses or equivalent safeguards; for children under GDPR-K we rely on verifiable parental consent.
9. Your rights & choices
Parents can access, correct, or delete account and kid-profile data at any time from the parent dashboard, and withdraw consent by deleting the account (Parent → Settings → Delete account). Residents of the EEA, UK, California and similar regions have additional rights, including lodging a complaint with a supervisory authority. Contact [email protected].
10. Security
Passwords and PINs are stored only as hashes, traffic is encrypted in transit (HTTPS), and access to production data is restricted. No system is perfectly secure, but we work hard to protect your family's data.
11. Contact
Questions or requests? Email [email protected]. For COPPA-specific inquiries, put "COPPA REQUEST" in the subject line. Postal: Blink22, United Arab Emirates.